@zuplo/runtime 7.13.10 → 7.14.0

package/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{G as p,L as c,O as u}from"../chunk-SXGSDVGB.js";import"../chunk-ZCJ5QBVD.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import{aa as i}from"../chunk-PXS4NOKU.js";import"../chunk-UKQQD2JN.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
+import{G as p,L as c,O as u}from"../chunk-4SVXBKXH.js";import"../chunk-VP5Q3DEN.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import{aa as i}from"../chunk-WUZE2HKB.js";import"../chunk-UKQQD2JN.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
 //# sourceMappingURL=index.js.map

package/out/esm/sdks/aws/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{Ia as a,Ja as l,Ka as c,La as o,Oa as p,Pa as y,Qa as m}from"../../chunk-PXS4NOKU.js";import"../../chunk-UKQQD2JN.js";import{a as i}from"../../chunk-TYV53J3B.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
+import{Ia as a,Ja as l,Ka as c,La as o,Oa as p,Pa as y,Qa as m}from"../../chunk-WUZE2HKB.js";import"../../chunk-UKQQD2JN.js";import{a as i}from"../../chunk-TYV53J3B.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
 //# sourceMappingURL=index.js.map

package/out/types/index.d.ts

@@ -4230,7 +4230,8 @@ declare type CompatibilityDate =
   | "2024-03-14"
   | "2024-09-02"
   | "2025-02-06"
-  | "2026-03-01";
+  | "2026-03-01"
+  | "2026-11-06";
 
 declare interface CompatibilityFlags {
   /**
@@ -4277,6 +4278,42 @@ declare interface CompatibilityFlags {
    * @compatibilityDate 2025-02-06
    */
   useForwardRedirectsPropOnUrlForwardHandler: boolean;
+  /**
+   * Whether the build matches an OpenAPI route's path literally, escaping
+   * the URLPattern special characters in it.
+   *
+   * Before this flag: The path is passed to URLPattern as written, after
+   * `{param}` becomes `:param`, so `/foo/{id}/(.*)` mixes URLPattern syntax
+   * into an OpenAPI path. A path that is not a valid URLPattern fails the
+   * build.
+   *
+   * After this flag: `* + ? ( ) [ ] . | ^ $ \ :` in the path are escaped, so
+   * each matches only itself, and `{param}` is the only placeholder.
+   *
+   * The build reads this flag; the runtime does not.
+   *
+   * @compatibilityDate 2025-02-06
+   */
+  escapeOpenApiPathCharacters: boolean;
+  /**
+   * Whether an OpenAPI path parameter ends at its closing `}`, so a path
+   * such as `/x/{id}abc` binds `id` as written.
+   *
+   * Before this flag: The build writes `{id}` as `:id`. URLPattern reads a
+   * name for as long as the next characters are letters, digits, `_` or `$`,
+   * so `/x/{id}abc` becomes `/x/:idabc`: it matches `/x/<anything>` and sets
+   * `idabc`, never `id`. The build warns about each such path.
+   *
+   * After this flag: When a letter, digit, `_` or `$` follows the `}`, the
+   * build writes `{:id}abc`, so `/x/fooabc` matches with `id` set to `foo`
+   * and `/x/foo` does not match. `mcpServerHandler` writes the parameter's
+   * value in its place. Other paths build exactly as before.
+   *
+   * The build and the MCP server handler read this flag.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  delimitOpenApiPathParameters: boolean;
   /**
    * Whether response sending hooks should chain properly, where each hook
    * receives the response from the previous hook instead of the original response.
@@ -4318,6 +4355,8 @@ declare interface CompatibilityFlags {
    * and `allOf`. `request-validation-inbound` validates with the same dialect,
    * `format` and pattern rules, and keeps its parameter type coercion
    * (specs/compat-improved-schema-validation.md).
+   *
+   * @compatibilityDate 2026-11-06
    */
   improvedSchemaValidation: boolean;
   /**
@@ -4334,6 +4373,8 @@ declare interface CompatibilityFlags {
    * Style Examples table says, for example `rgb[R]=100&rgb[G]=200` for a
    * `deepObject` and `.blue.black.brown` for a path `label`. Values are
    * percent-encoded as UTF-8 and a space is `%20`.
+   *
+   * @compatibilityDate 2026-11-06
    */
   serializeMcpParametersByStyle: boolean;
   /**
@@ -4360,6 +4401,8 @@ declare interface CompatibilityFlags {
    *
    * The build warns about every name that breaks the rule or repeats, with or
    * without this flag. Set `x-zuplo-route.mcp.name` to keep a name stable.
+   *
+   * @compatibilityDate 2026-11-06
    */
   sanitizeMcpToolNames: boolean;
   /**
@@ -4384,6 +4427,8 @@ declare interface CompatibilityFlags {
    * - Before `2025-03-26`: tools also leave out `annotations`.
    *
    * `_meta` is sent on every version.
+   *
+   * @compatibilityDate 2026-11-06
    */
   omitMcpFieldsNewerThanNegotiatedVersion: boolean;
   /**
@@ -4405,8 +4450,40 @@ declare interface CompatibilityFlags {
    * secrets, and options whose unset default grants more access keep their
    * current behavior. `BLANK_IS_NOT_UNSET` in
    * `policies/optional-string-options.spec.ts` lists them with the reason.
+   *
+   * @compatibilityDate 2026-11-06
    */
   treatBlankOptionalStringOptionsAsUnset: boolean;
+  /**
+   * Whether the MCP server handler answers `resources/read` with a JSON-RPC
+   * error when the resource's route answers an error status.
+   *
+   * Before this flag: The route's response body is returned as the
+   * resource's contents whatever its status, so a route's 403 problem+json
+   * reaches the client as a successful read.
+   *
+   * After this flag: A status outside 200 to 299, a redirect included,
+   * answers `resources/read` with JSON-RPC error -32603 naming the resource,
+   * its URI and the status, with `data: { uri, status }`. The route's body is
+   * not read or sent.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  failMcpResourceReadsOnErrorStatus: boolean;
+  /**
+   * Whether the build fails for an MCP resource URI that is not an absolute
+   * RFC 3986 URI.
+   *
+   * Before this flag: `x-zuplo-route.mcp.uri` (or the deprecated
+   * `x-zuplo-mcp-resource.uri`) is advertised and served as written, for
+   * example `audit doc with spaces`. The build warns.
+   *
+   * After this flag: The build fails, naming the operation, its file and the
+   * URI. The default URI (`mcp://resources/<name>`) is always valid.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  rejectInvalidMcpResourceUris: boolean;
 }
 
 declare interface CompletionsFallbacks {

package/out/types/internal/index.d.ts

@@ -101,7 +101,8 @@ declare type CompatibilityDate =
   | "2024-03-14"
   | "2024-09-02"
   | "2025-02-06"
-  | "2026-03-01";
+  | "2026-03-01"
+  | "2026-11-06";
 
 declare interface CompatibilityFlags {
   /**
@@ -148,6 +149,42 @@ declare interface CompatibilityFlags {
    * @compatibilityDate 2025-02-06
    */
   useForwardRedirectsPropOnUrlForwardHandler: boolean;
+  /**
+   * Whether the build matches an OpenAPI route's path literally, escaping
+   * the URLPattern special characters in it.
+   *
+   * Before this flag: The path is passed to URLPattern as written, after
+   * `{param}` becomes `:param`, so `/foo/{id}/(.*)` mixes URLPattern syntax
+   * into an OpenAPI path. A path that is not a valid URLPattern fails the
+   * build.
+   *
+   * After this flag: `* + ? ( ) [ ] . | ^ $ \ :` in the path are escaped, so
+   * each matches only itself, and `{param}` is the only placeholder.
+   *
+   * The build reads this flag; the runtime does not.
+   *
+   * @compatibilityDate 2025-02-06
+   */
+  escapeOpenApiPathCharacters: boolean;
+  /**
+   * Whether an OpenAPI path parameter ends at its closing `}`, so a path
+   * such as `/x/{id}abc` binds `id` as written.
+   *
+   * Before this flag: The build writes `{id}` as `:id`. URLPattern reads a
+   * name for as long as the next characters are letters, digits, `_` or `$`,
+   * so `/x/{id}abc` becomes `/x/:idabc`: it matches `/x/<anything>` and sets
+   * `idabc`, never `id`. The build warns about each such path.
+   *
+   * After this flag: When a letter, digit, `_` or `$` follows the `}`, the
+   * build writes `{:id}abc`, so `/x/fooabc` matches with `id` set to `foo`
+   * and `/x/foo` does not match. `mcpServerHandler` writes the parameter's
+   * value in its place. Other paths build exactly as before.
+   *
+   * The build and the MCP server handler read this flag.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  delimitOpenApiPathParameters: boolean;
   /**
    * Whether response sending hooks should chain properly, where each hook
    * receives the response from the previous hook instead of the original response.
@@ -189,6 +226,8 @@ declare interface CompatibilityFlags {
    * and `allOf`. `request-validation-inbound` validates with the same dialect,
    * `format` and pattern rules, and keeps its parameter type coercion
    * (specs/compat-improved-schema-validation.md).
+   *
+   * @compatibilityDate 2026-11-06
    */
   improvedSchemaValidation: boolean;
   /**
@@ -205,6 +244,8 @@ declare interface CompatibilityFlags {
    * Style Examples table says, for example `rgb[R]=100&rgb[G]=200` for a
    * `deepObject` and `.blue.black.brown` for a path `label`. Values are
    * percent-encoded as UTF-8 and a space is `%20`.
+   *
+   * @compatibilityDate 2026-11-06
    */
   serializeMcpParametersByStyle: boolean;
   /**
@@ -231,6 +272,8 @@ declare interface CompatibilityFlags {
    *
    * The build warns about every name that breaks the rule or repeats, with or
    * without this flag. Set `x-zuplo-route.mcp.name` to keep a name stable.
+   *
+   * @compatibilityDate 2026-11-06
    */
   sanitizeMcpToolNames: boolean;
   /**
@@ -255,6 +298,8 @@ declare interface CompatibilityFlags {
    * - Before `2025-03-26`: tools also leave out `annotations`.
    *
    * `_meta` is sent on every version.
+   *
+   * @compatibilityDate 2026-11-06
    */
   omitMcpFieldsNewerThanNegotiatedVersion: boolean;
   /**
@@ -276,8 +321,40 @@ declare interface CompatibilityFlags {
    * secrets, and options whose unset default grants more access keep their
    * current behavior. `BLANK_IS_NOT_UNSET` in
    * `policies/optional-string-options.spec.ts` lists them with the reason.
+   *
+   * @compatibilityDate 2026-11-06
    */
   treatBlankOptionalStringOptionsAsUnset: boolean;
+  /**
+   * Whether the MCP server handler answers `resources/read` with a JSON-RPC
+   * error when the resource's route answers an error status.
+   *
+   * Before this flag: The route's response body is returned as the
+   * resource's contents whatever its status, so a route's 403 problem+json
+   * reaches the client as a successful read.
+   *
+   * After this flag: A status outside 200 to 299, a redirect included,
+   * answers `resources/read` with JSON-RPC error -32603 naming the resource,
+   * its URI and the status, with `data: { uri, status }`. The route's body is
+   * not read or sent.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  failMcpResourceReadsOnErrorStatus: boolean;
+  /**
+   * Whether the build fails for an MCP resource URI that is not an absolute
+   * RFC 3986 URI.
+   *
+   * Before this flag: `x-zuplo-route.mcp.uri` (or the deprecated
+   * `x-zuplo-mcp-resource.uri`) is advertised and served as written, for
+   * example `audit doc with spaces`. The build warns.
+   *
+   * After this flag: The build fails, naming the operation, its file and the
+   * URI. The default URI (`mcp://resources/<name>`) is always valid.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  rejectInvalidMcpResourceUris: boolean;
 }
 
 /**
@@ -1231,6 +1308,18 @@ declare type Iso3166Alpha2Code =
 
 /* Excluded from this release type: isRestrictedEnvVariableName */
 
+/**
+ * Whether `uri` is an absolute RFC 3986 URI (section 3: `scheme ":"
+ * hier-part [ "?" query ] [ "#" fragment ]`), as MCP requires a resource URI
+ * to be (compat-reject-invalid-mcp-resource-uris MCPRESURI-1). The structure
+ * is checked, not just the characters: a bracketed host must be an IP
+ * literal, a port must be digits, and a fragment holds no second `#`. Any
+ * scheme is allowed, so custom schemes such as `docs:` pass.
+ *
+ * @param uri - the resource URI as the handler advertises it (trimmed)
+ */
+export declare function isValidMcpResourceUri(uri: string): boolean;
+
 /* Excluded from this release type: isZuploReadableEnvVariableName */
 
 declare type JsonArray = JsonValue[] | readonly JsonValue[];
@@ -1311,6 +1400,36 @@ declare interface Logger extends BaseLogger {
   ): void;
 }
 
+/** The name and URI `resources/list` advertises for a resource. */
+export declare interface McpResourceIdentity {
+  /**
+   * The resource's name. Empty only on the `"resources"` path for an
+   * operation with neither a name nor an operationId, which the handler
+   * refuses at startup.
+   */
+  name: string;
+  /** The advertised URI: the configured one, trimmed, or the default. */
+  uri: string;
+  /** Whether the URI is configured (non-empty after trimming), not the default. */
+  configured: boolean;
+}
+
+/** The part of a resource extension that names a resource and its URI. */
+export declare interface McpResourceIdentityConfig {
+  name?: string;
+  uri?: string;
+}
+
+/**
+ * How `mcpServerHandler` registers a resource, which decides the extension
+ * its name and URI come from:
+ * - `"operations"`: `options.operations`, from `x-zuplo-route.mcp` with
+ *   `type: "resource"`.
+ * - `"resources"`: the deprecated `options.resources`, from
+ *   `x-zuplo-mcp-resource`.
+ */
+export declare type McpResourceRegistration = "operations" | "resources";
+
 declare type Modify<T, R> = Omit<T, keyof R> & R;
 
 /**
@@ -2025,6 +2144,23 @@ declare interface RequestUser<TUserData> {
   data: TUserData;
 }
 
+/**
+ * The name and URI `mcpServerHandler` advertises for an operation it registers
+ * as a resource. The handler and the build's resource URI check
+ * (compat-reject-invalid-mcp-resource-uris MCPRESURI-1) both decide it here.
+ * An empty URI gets the default, `mcp://resources/<encoded name>`.
+ *
+ * @param operationId - the operation's operationId
+ * @param config - `x-zuplo-route.mcp` for `"operations"`,
+ *   `x-zuplo-mcp-resource` for `"resources"`
+ * @param registration - the handler option that registers the resource
+ */
+export declare function resolveMcpResourceIdentity(
+  operationId: string,
+  config: McpResourceIdentityConfig | undefined,
+  registration: McpResourceRegistration
+): McpResourceIdentity;
+
 declare type ResolveRequestParams<
   TParams extends RequestParamsDefault | undefined,
 > = TParams extends RequestParamsDefault ? TParams : RequestParamsDefault;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.13.10",
+  "version": "7.14.0",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {